PT-2025-52367 · Vega+1 · Vega+1

Ismisepaul + 1 · Published 2025-12-18 · Updated 2026-02-24 · CVE-2025-68385

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vega (affected versions not specified)

Description An issue exists where improper input neutralization during web page generation allows an authenticated user to embed a malicious script in content served to web browsers. This results in cross-site scripting (XSS) via a method in Vega, bypassing a previous XSS mitigation. The issue allows for browser-side script execution and potential data theft through Vega charts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-ELK-2025-68385

BIT-KIBANA-2025-68385

CVE-2025-68385

Affected Products

Red Os

Vega

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-68385 · Security Note
• https://discuss.elastic.co/t/kibana-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-34/384182 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68385 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-kibana-cve-2025-68385-8.0 · Note
• https://t.me/CVEtracker/40204 · Telegram Post
• https://t.me/cveNotify/146270 · Telegram Post
• https://twitter.com/CCBalert/status/2002029709115154769 · Twitter Post
• https://t.me/netlas/525 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2001918181561045359 · Twitter Post
• https://twitter.com/Netlas_io/status/2003748906002211251 · Twitter Post
• https://twitter.com/CVEnew/status/2002099231281254437 · Twitter Post